assert "_kernel_lock_held()" failed in kern_event.c
3 views
Skip to first unread message
syzbot
May 1, 2019, 4:14:06 PM5/1/19
to syzkaller-o...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: 9542d0df Pull tname initialization up since it's used in a..
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=127abcff200000
kernel config: https://syzkaller.appspot.com/x/.config?x=fa145722143cbd64
dashboard link: https://syzkaller.appspot.com/bug?extid=c9a16d01c3b1eb8d5b65
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+c9a16d...@syzkaller.appspotmail.com
spanic: kernel diagnostic assertion "_kernel_lock_held()" failed:
file "/syzkaller/managers/multicore/kernel/sys/kern/kern_event.c", line 1076
Stopped at db_enter+0x18: addq $0x8,%rsp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
35556 30286 0 0 0 1 syz-executor.0
*138178 61528 0 0x14000 0x200 0 smr
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic() at panic+0x15c sys/kern/subr_prf.c:208
__assert(ffffffff81f8d87b,ffffffff81f8556f,434,ffffffff81f979c3) at
__assert+0x2e sys/kern/subr_prf.c:155
knote_enqueue(fffffd806ec4cc40) at knote_enqueue+0x216
sys/kern/kern_event.c:1076
knote(ffffffff82365100,1000000) at knote+0xbd sys/kern/kern_event.c:957
selwakeup(ffffffff82365100) at selwakeup+0x3b sys/kern/sys_generic.c:795
logwakeup() at logwakeup+0x3b sys/kern/subr_log.c:310
printf(ffffffff81f8117a) at printf+0x9f sys/kern/subr_prf.c:519
smr_thread(ffff800020ac19c8) at smr_thread+0x335 sys/kern/kern_smr.c:114
end trace frame: 0x0, count: 6
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{0}>
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
kernel diagnostic assertion "_kernel_lock_held()" failed:
file "/syzkaller/managers/multicore/kernel/sys/kern/kern_event.c", line 1076
ddb{0}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic() at panic+0x15c sys/kern/subr_prf.c:208
__assert(ffffffff81f8d87b,ffffffff81f8556f,434,ffffffff81f979c3) at
__assert+0x2e sys/kern/subr_prf.c:155
knote_enqueue(fffffd806ec4cc40) at knote_enqueue+0x216
sys/kern/kern_event.c:1076
knote(ffffffff82365100,1000000) at knote+0xbd sys/kern/kern_event.c:957
selwakeup(ffffffff82365100) at selwakeup+0x3b sys/kern/sys_generic.c:795
logwakeup() at logwakeup+0x3b sys/kern/subr_log.c:310
printf(ffffffff81f8117a) at printf+0x9f sys/kern/subr_prf.c:519
smr_thread(ffff800020ac19c8) at smr_thread+0x335 sys/kern/kern_smr.c:114
end trace frame: 0x0, count: -9
ddb{0}> show registers
rdi 0
rsi 0x1
rbp 0xffff800020ac8d30
rbx 0xffff800020ac8de0
rdx 0xffff800020ac19c8
rcx 0
rax 0
r8 0xffffffff81887573 kprintf+0x173
r9 0x1
r10 0x25
r11 0xc446a409be04e4ae
r12 0x3000000008
r13 0xffff800020ac8d40
r14 0x100
r15 0x1
rip 0xffffffff815672f8 db_enter+0x18
cs 0x8
rflags 0x246
rsp 0xffff800020ac8d20
ss 0x10
db_enter+0x18: addq $0x8,%rsp
ddb{0}> show proc
PROC (smr) pid=138178 stat=onproc
flags process=14000<NOZOMBIE,SYSTEM> proc=200<SYSTEM>
pri=50, usrpri=50, nice=20
forw=0xffffffffffffffff, list=0xffff800020ac1c20,0xffff800020ac12d0
process=0xffff800020ac2690 user=0xffff800020ac4000,
vmspace=0xffffffff823822e0
estcpu=0, cpticks=0, pctcpu=0.0
user=0, sys=0, intr=0
ddb{0}> ps
PID TID PPID UID S FLAGS WAIT COMMAND
30286 35556 83518 0 7 0 syz-executor.0
30286 496975 83518 0 2 0x4000000 syz-executor.0
30286 363240 83518 0 2 0x4000000 syz-executor.0
75829 340737 14137 0 2 0 syz-executor.1
75829 399476 14137 0 2 0x4000000 syz-executor.1
83518 289726 82223 0 3 0x82 wait syz-executor.0
14137 30134 82223 0 3 0x82 wait syz-executor.1
15444 199002 0 0 3 0x14200 bored sosplice
82223 60087 23474 0 3 0x82 thrsleep syz-fuzzer
82223 257090 23474 0 3 0x4000082 nanosleep syz-fuzzer
82223 351504 23474 0 3 0x4000082 thrsleep syz-fuzzer
82223 231626 23474 0 3 0x4000082 thrsleep syz-fuzzer
82223 281932 23474 0 3 0x4000082 thrsleep syz-fuzzer
82223 522964 23474 0 2 0x4000082 syz-fuzzer
82223 325623 23474 0 3 0x4000082 thrsleep syz-fuzzer
82223 431585 23474 0 3 0x4000082 thrsleep syz-fuzzer
82223 65358 23474 0 3 0x4000082 thrsleep syz-fuzzer
82223 156406 23474 0 3 0x4000082 thrsleep syz-fuzzer
82223 277004 23474 0 3 0x4000082 kqread syz-fuzzer
23474 469942 55631 0 3 0x10008a pause ksh
55631 396995 27352 0 3 0x92 select sshd
50154 84998 1 0 3 0x100083 ttyin getty
27352 163327 1 0 3 0x80 select sshd
69321 362006 40995 74 3 0x100092 bpf pflogd
40995 402168 1 0 3 0x80 netio pflogd
3037 412959 38856 73 3 0x100090 kqread syslogd
38856 468294 1 0 3 0x100082 netio syslogd
85536 259479 1 77 3 0x100090 poll dhclient
73928 15999 1 0 3 0x80 poll dhclient
55932 401690 0 0 2 0x14200 zerothread
94890 427094 0 0 3 0x14200 aiodoned aiodoned
28585 4891 0 0 3 0x14200 syncer update
38890 165051 0 0 3 0x14200 cleaner cleaner
35196 373618 0 0 3 0x14200 reaper reaper
31934 345198 0 0 3 0x14200 pgdaemon pagedaemon
83678 14201 0 0 3 0x14200 bored crynlk
31250 349419 0 0 3 0x14200 bored crypto
57272 195438 0 0 3 0x40014200 acpi0 acpi0
35991 178799 0 0 3 0x40014200 idle1
17867 315410 0 0 2 0x14200 softnet
65209 450287 0 0 3 0x14200 bored systqmp
14650 333877 0 0 3 0x14200 bored systq
92365 34187 0 0 3 0x40014200 bored softclock
3962 283621 0 0 3 0x40014200 idle0
*61528 138178 0 0 7 0x14200 smr
1 118646 0 0 3 0x82 wait init
0 0 -1 0 3 0x10200 scheduler swapper
ddb{0}> show all locks
Process 30286 (syz-executor.0) thread 0xffff800020b6fc38 (35556)
exclusive rwlock vmmaplk r = 0 (0xfffffd807effe5b8)
#0 witness_lock+0x52e sys/kern/subr_witness.c:1161
#1 rw_enter+0x414 sys/kern/kern_rwlock.c:278
#2 vm_map_lock_ln+0x10d sys/uvm/uvm_map.c:5260
#3 uvm_mapanon+0x1e6 sys/uvm/uvm_map.c:991
#4 sys_mmap+0xa9a uvm_mmapanon sys/uvm/uvm_mmap.c:921 [inline]
#4 sys_mmap+0xa9a sys/uvm/uvm_mmap.c:421
#5 syscall+0x552 mi_syscall sys/sys/syscall_mi.h:99 [inline]
#5 syscall+0x552 sys/arch/amd64/amd64/trap.c:574
#6 Xsyscall+0x128
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff82377bc0)
#0 witness_lock+0x52e sys/kern/subr_witness.c:1161
#1 syscall+0x43a mi_syscall sys/sys/syscall_mi.h:91 [inline]
#1 syscall+0x43a sys/arch/amd64/amd64/trap.c:574
#2 Xsyscall+0x128
ddb{0}> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim Kern Lim
devbuf 9580 6442K 14625K 78643K 14794 0 0
pcb 25 9K 11K 78643K 761 0 0
rtable 100 3K 4K 78643K 986 0 0
ifaddr 80 17K 17K 78643K 322 0 0
counters 39 33K 33K 78643K 39 0 0
ioctlops 0 0K 4K 78643K 1519 0 0
iov 0 0K 24K 78643K 1208 0 0
mount 1 1K 1K 78643K 1 0 0
vnodes 1194 75K 76K 78643K 3341 0 0
UFS quota 1 32K 32K 78643K 1 0 0
UFS mount 5 36K 36K 78643K 5 0 0
shm 2 1K 5K 78643K 36 0 0
VM map 2 1K 1K 78643K 2 0 0
sem 12 1K 1K 78643K 284 0 0
dirhash 12 2K 2K 78643K 12 0 0
ACPI 1808 196K 290K 78643K 12628 0 0
file desc 6 17K 21K 78643K 2513 0 0
sigio 0 0K 0K 78643K 18 0 0
proc 54 51K 71K 78643K 808 0 0
subproc 64 65538K 67586K 78643K 648 0 0
NFS srvsock 1 0K 0K 78643K 1 0 0
NFS daemon 1 16K 16K 78643K 1 0 0
ip_moptions 0 0K 0K 78643K 114 0 0
in_multi 33 2K 2K 78643K 250 0 0
ether_multi 1 0K 0K 78643K 9 0 0
mrt 0 0K 0K 78643K 8 0 0
ISOFS mount 1 32K 32K 78643K 1 0 0
MSDOSFS mount 1 16K 16K 78643K 1 0 0
ttys 72 318K 318K 78643K 72 0 0
exec 0 0K 1K 78643K 379 0 0
pagedep 1 8K 8K 78643K 1 0 0
inodedep 1 32K 32K 78643K 1 0 0
newblk 1 0K 0K 78643K 1 0 0
VM swap 7 26K 26K 78643K 7 0 0
UVM amap 90 21K 30K 78643K 8414 0 0
UVM aobj 98 5K 5K 78643K 102 0 0
memdesc 1 4K 4K 78643K 1 0 0
crypto data 1 1K 1K 78643K 1 0 0
ip6_options 0 0K 0K 78643K 75 0 0
NDP 19 0K 0K 78643K 110 0 0
temp 221 2716K 2786K 78643K 10860 0 0
kqueue 0 0K 0K 78643K 18 0 0
SYN cache 2 16K 16K 78643K 2 0 0
ddb{0}> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg
Idle
arp 64 21 0 17 1 0 1 1 0
8 0
inpcbpl 280 954 0 947 2 1 1 2 0
8 0
plimitpl 152 102 0 94 1 0 1 1 0
8 0
plcache 128 20 0 0 1 0 1 1 0
8 0
rtentry 112 194 0 154 2 0 2 2 0
8 0
syncache 264 4 0 4 1 1 0 1 0
8 0
tcpqe 32 12 0 12 1 1 0 1 0
8 0
tcpcb 544 197 0 193 1 0 1 1 0
8 0
nd6 48 38 0 34 1 0 1 1 0
8 0
swfcl 56 1 0 0 1 0 1 1 0
8 0
ppxss 1128 28 0 28 6 6 0 1 0
8 0
pfosfp 40 846 0 423 5 0 5 5 0
8 0
pfosfpen 112 1428 0 714 21 0 21 21 0
8 0
pfstitem 24 45 0 38 1 0 1 1 0
8 0
pfstkey 112 45 0 38 1 0 1 1 0
8 0
pfstate 328 45 0 38 2 0 2 2 0
8 0
pfrule 1360 21 0 16 2 1 1 2 0
8 0
art_heap8 4096 1 0 0 1 0 1 1 0
8 0
art_heap4 256 917 0 726 12 0 12 12 0
8 0
art_table 32 918 0 726 2 0 2 2 0
8 0
art_node 16 193 0 159 1 0 1 1 0
8 0
sysvmsgpl 40 11 0 3 1 0 1 1 0
8 0
semupl 112 1 0 1 1 1 0 1 0
8 0
semapl 112 277 0 267 1 0 1 1 0
8 0
shmpl 112 100 0 4 3 0 3 3 0
8 0
dirhash 1024 17 0 0 3 0 3 3 0
8 0
dino1pl 128 6152 0 4684 49 1 48 48 0
8 0
ffsino 272 6152 0 4684 102 3 99 99 0
8 0
nchpl 144 9774 0 8106 62 0 62 62 0
8 0
uvmvnodes 72 5926 0 0 108 0 108 108 0
8 0
vnodes 200 5926 0 0 312 0 312 312 0
8 0
namei 1024 28205 0 28205 2 2 0 1 0
8 0
percpumem 16 30 0 0 1 0 1 1 0
8 0
scsiplug 64 3 0 3 2 2 0 1 0
8 0
scxspl 192 26117 0 26117 18 15 3 6 0
8 3
sigapl 432 2661 0 2645 2 0 2 2 0
8 0
futexpl 56 25052 0 25052 1 1 0 1 0
8 0
knotepl 112 634 0 615 2 1 1 2 0
8 0
kqueuepl 104 303 0 301 1 0 1 1 0
8 0
pipepl 112 1192 0 1173 3 2 1 2 0
8 0
fdescpl 488 2662 0 2645 4 1 3 3 0
8 0
filepl 152 13147 0 13047 8 4 4 7 0
8 0
lockfpl 104 501 0 501 4 4 0 1 0
8 0
lockfspl 32 182 0 182 4 4 0 1 0
8 0
sessionpl 112 35 0 24 1 0 1 1 0
8 0
pgrppl 48 53 0 42 1 0 1 1 0
8 0
ucredpl 96 1651 0 1642 1 0 1 1 0
8 0
zombiepl 144 2645 0 2645 3 3 0 1 0
8 0
processpl 840 2678 0 2645 4 0 4 4 0
8 0
procpl 600 7359 0 7313 4 0 4 4 0
8 0
srpgc 64 102 0 102 8 8 0 1 0
8 0
sosppl 128 11 0 11 5 5 0 1 0
8 0
sockpl 384 1574 0 1555 5 3 2 4 0
8 0
mcl64k 65536 350 0 0 37 3 34 34 0
8 0
mcl16k 16384 2 0 0 1 0 1 1 0
8 0
mcl12k 12288 17 0 0 2 0 2 2 0
8 0
mcl9k 9216 10 0 0 1 0 1 1 0
8 0
mcl8k 8192 13 0 0 2 0 2 2 0
8 0
mcl4k 4096 7 0 0 1 0 1 1 0
8 0
mcl2k2 2112 5 0 0 1 0 1 1 0
8 0
mcl2k 2048 129 0 0 15 0 15 15 0
8 0
mtagpl 80 1 0 0 1 0 1 1 0
8 0
mbufpl 256 467 0 0 21 0 21 21 0
8 0
bufpl 256 10001 0 2981 439 0 439 439 0
8 0
anonpl 16 257991 0 242735 102 40 62 62 0
125 0
amapchunkpl 152 15115 0 14994 34 28 6 10 0
158 0
amappl16 192 12358 0 11437 80 33 47 47 0
8 0
amappl15 184 868 0 867 3 2 1 1 0
8 0
amappl14 176 79 0 77 2 1 1 1 0
8 0
amappl13 168 283 0 283 5 5 0 1 0
8 0
amappl12 160 1071 0 1068 2 1 1 1 0
8 0
amappl11 152 347 0 328 1 0 1 1 0
8 0
amappl10 144 73 0 69 1 0 1 1 0
8 0
amappl9 136 832 0 828 1 0 1 1 0
8 0
amappl8 128 400 0 383 1 0 1 1 0
8 0
amappl7 120 70 0 63 1 0 1 1 0
8 0
amappl6 112 378 0 372 1 0 1 1 0
8 0
amappl5 104 1226 0 1210 1 0 1 1 0
8 0
amappl4 96 2084 0 2052 2 1 1 2 0
8 0
amappl3 88 1100 0 1094 1 0 1 1 0
8 0
amappl2 80 22521 0 22455 2 0 2 2 0
8 0
amappl1 72 63947 0 63487 26 16 10 20 0
8 0
amappl 72 7751 0 7713 1 0 1 1 0
75 0
dma4096 4096 1 0 1 1 1 0 1 0
8 0
dma256 256 6 0 6 1 1 0 1 0
8 0
dma64 64 259 0 259 1 1 0 1 0
8 0
dma32 32 7 0 7 1 1 0 1 0
8 0
dma16 16 17 0 17 1 1 0 1 0
8 0
aobjpl 64 101 0 4 2 0 2 2 0
8 0
uaddrrnd 24 2662 0 2645 1 0 1 1 0
8 0
uaddrbest 32 2 0 0 1 0 1 1 0
8 0
uaddr 24 2662 0 2645 1 0 1 1 0
8 0
vmmpekpl 168 22338 0 22312 2 0 2 2 0
8 0
vmmpepl 168 286952 0 284936 162 69 93 99 0
357 5
vmsppl 360 2661 0 2645 2 0 2 2 0
8 0
pdppl 4096 5332 0 5290 7 1 6 6 0
8 0
pvpl 32 757476 0 738418 227 73 154 155 0
265 0
pmappl 232 2661 0 2645 2 1 1 2 0
8 0
extentpl 40 39 0 25 1 0 1 1 0
8 0
phpool 112 648 0 12 19 0 19 19 0
8 0
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following crash on:
HEAD commit: 9542d0df Pull tname initialization up since it's used in a..
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=127abcff200000
kernel config: https://syzkaller.appspot.com/x/.config?x=fa145722143cbd64
dashboard link: https://syzkaller.appspot.com/bug?extid=c9a16d01c3b1eb8d5b65
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+c9a16d...@syzkaller.appspotmail.com
spanic: kernel diagnostic assertion "_kernel_lock_held()" failed:
file "/syzkaller/managers/multicore/kernel/sys/kern/kern_event.c", line 1076
Stopped at db_enter+0x18: addq $0x8,%rsp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
35556 30286 0 0 0 1 syz-executor.0
*138178 61528 0 0x14000 0x200 0 smr
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic() at panic+0x15c sys/kern/subr_prf.c:208
__assert(ffffffff81f8d87b,ffffffff81f8556f,434,ffffffff81f979c3) at
__assert+0x2e sys/kern/subr_prf.c:155
knote_enqueue(fffffd806ec4cc40) at knote_enqueue+0x216
sys/kern/kern_event.c:1076
knote(ffffffff82365100,1000000) at knote+0xbd sys/kern/kern_event.c:957
selwakeup(ffffffff82365100) at selwakeup+0x3b sys/kern/sys_generic.c:795
logwakeup() at logwakeup+0x3b sys/kern/subr_log.c:310
printf(ffffffff81f8117a) at printf+0x9f sys/kern/subr_prf.c:519
smr_thread(ffff800020ac19c8) at smr_thread+0x335 sys/kern/kern_smr.c:114
end trace frame: 0x0, count: 6
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{0}>
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
kernel diagnostic assertion "_kernel_lock_held()" failed:
file "/syzkaller/managers/multicore/kernel/sys/kern/kern_event.c", line 1076
ddb{0}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic() at panic+0x15c sys/kern/subr_prf.c:208
__assert(ffffffff81f8d87b,ffffffff81f8556f,434,ffffffff81f979c3) at
__assert+0x2e sys/kern/subr_prf.c:155
knote_enqueue(fffffd806ec4cc40) at knote_enqueue+0x216
sys/kern/kern_event.c:1076
knote(ffffffff82365100,1000000) at knote+0xbd sys/kern/kern_event.c:957
selwakeup(ffffffff82365100) at selwakeup+0x3b sys/kern/sys_generic.c:795
logwakeup() at logwakeup+0x3b sys/kern/subr_log.c:310
printf(ffffffff81f8117a) at printf+0x9f sys/kern/subr_prf.c:519
smr_thread(ffff800020ac19c8) at smr_thread+0x335 sys/kern/kern_smr.c:114
end trace frame: 0x0, count: -9
ddb{0}> show registers
rdi 0
rsi 0x1
rbp 0xffff800020ac8d30
rbx 0xffff800020ac8de0
rdx 0xffff800020ac19c8
rcx 0
rax 0
r8 0xffffffff81887573 kprintf+0x173
r9 0x1
r10 0x25
r11 0xc446a409be04e4ae
r12 0x3000000008
r13 0xffff800020ac8d40
r14 0x100
r15 0x1
rip 0xffffffff815672f8 db_enter+0x18
cs 0x8
rflags 0x246
rsp 0xffff800020ac8d20
ss 0x10
db_enter+0x18: addq $0x8,%rsp
ddb{0}> show proc
PROC (smr) pid=138178 stat=onproc
flags process=14000<NOZOMBIE,SYSTEM> proc=200<SYSTEM>
pri=50, usrpri=50, nice=20
forw=0xffffffffffffffff, list=0xffff800020ac1c20,0xffff800020ac12d0
process=0xffff800020ac2690 user=0xffff800020ac4000,
vmspace=0xffffffff823822e0
estcpu=0, cpticks=0, pctcpu=0.0
user=0, sys=0, intr=0
ddb{0}> ps
PID TID PPID UID S FLAGS WAIT COMMAND
30286 35556 83518 0 7 0 syz-executor.0
30286 496975 83518 0 2 0x4000000 syz-executor.0
30286 363240 83518 0 2 0x4000000 syz-executor.0
75829 340737 14137 0 2 0 syz-executor.1
75829 399476 14137 0 2 0x4000000 syz-executor.1
83518 289726 82223 0 3 0x82 wait syz-executor.0
14137 30134 82223 0 3 0x82 wait syz-executor.1
15444 199002 0 0 3 0x14200 bored sosplice
82223 60087 23474 0 3 0x82 thrsleep syz-fuzzer
82223 257090 23474 0 3 0x4000082 nanosleep syz-fuzzer
82223 351504 23474 0 3 0x4000082 thrsleep syz-fuzzer
82223 231626 23474 0 3 0x4000082 thrsleep syz-fuzzer
82223 281932 23474 0 3 0x4000082 thrsleep syz-fuzzer
82223 522964 23474 0 2 0x4000082 syz-fuzzer
82223 325623 23474 0 3 0x4000082 thrsleep syz-fuzzer
82223 431585 23474 0 3 0x4000082 thrsleep syz-fuzzer
82223 65358 23474 0 3 0x4000082 thrsleep syz-fuzzer
82223 156406 23474 0 3 0x4000082 thrsleep syz-fuzzer
82223 277004 23474 0 3 0x4000082 kqread syz-fuzzer
23474 469942 55631 0 3 0x10008a pause ksh
55631 396995 27352 0 3 0x92 select sshd
50154 84998 1 0 3 0x100083 ttyin getty
27352 163327 1 0 3 0x80 select sshd
69321 362006 40995 74 3 0x100092 bpf pflogd
40995 402168 1 0 3 0x80 netio pflogd
3037 412959 38856 73 3 0x100090 kqread syslogd
38856 468294 1 0 3 0x100082 netio syslogd
85536 259479 1 77 3 0x100090 poll dhclient
73928 15999 1 0 3 0x80 poll dhclient
55932 401690 0 0 2 0x14200 zerothread
94890 427094 0 0 3 0x14200 aiodoned aiodoned
28585 4891 0 0 3 0x14200 syncer update
38890 165051 0 0 3 0x14200 cleaner cleaner
35196 373618 0 0 3 0x14200 reaper reaper
31934 345198 0 0 3 0x14200 pgdaemon pagedaemon
83678 14201 0 0 3 0x14200 bored crynlk
31250 349419 0 0 3 0x14200 bored crypto
57272 195438 0 0 3 0x40014200 acpi0 acpi0
35991 178799 0 0 3 0x40014200 idle1
17867 315410 0 0 2 0x14200 softnet
65209 450287 0 0 3 0x14200 bored systqmp
14650 333877 0 0 3 0x14200 bored systq
92365 34187 0 0 3 0x40014200 bored softclock
3962 283621 0 0 3 0x40014200 idle0
*61528 138178 0 0 7 0x14200 smr
1 118646 0 0 3 0x82 wait init
0 0 -1 0 3 0x10200 scheduler swapper
ddb{0}> show all locks
Process 30286 (syz-executor.0) thread 0xffff800020b6fc38 (35556)
exclusive rwlock vmmaplk r = 0 (0xfffffd807effe5b8)
#0 witness_lock+0x52e sys/kern/subr_witness.c:1161
#1 rw_enter+0x414 sys/kern/kern_rwlock.c:278
#2 vm_map_lock_ln+0x10d sys/uvm/uvm_map.c:5260
#3 uvm_mapanon+0x1e6 sys/uvm/uvm_map.c:991
#4 sys_mmap+0xa9a uvm_mmapanon sys/uvm/uvm_mmap.c:921 [inline]
#4 sys_mmap+0xa9a sys/uvm/uvm_mmap.c:421
#5 syscall+0x552 mi_syscall sys/sys/syscall_mi.h:99 [inline]
#5 syscall+0x552 sys/arch/amd64/amd64/trap.c:574
#6 Xsyscall+0x128
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff82377bc0)
#0 witness_lock+0x52e sys/kern/subr_witness.c:1161
#1 syscall+0x43a mi_syscall sys/sys/syscall_mi.h:91 [inline]
#1 syscall+0x43a sys/arch/amd64/amd64/trap.c:574
#2 Xsyscall+0x128
ddb{0}> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim Kern Lim
devbuf 9580 6442K 14625K 78643K 14794 0 0
pcb 25 9K 11K 78643K 761 0 0
rtable 100 3K 4K 78643K 986 0 0
ifaddr 80 17K 17K 78643K 322 0 0
counters 39 33K 33K 78643K 39 0 0
ioctlops 0 0K 4K 78643K 1519 0 0
iov 0 0K 24K 78643K 1208 0 0
mount 1 1K 1K 78643K 1 0 0
vnodes 1194 75K 76K 78643K 3341 0 0
UFS quota 1 32K 32K 78643K 1 0 0
UFS mount 5 36K 36K 78643K 5 0 0
shm 2 1K 5K 78643K 36 0 0
VM map 2 1K 1K 78643K 2 0 0
sem 12 1K 1K 78643K 284 0 0
dirhash 12 2K 2K 78643K 12 0 0
ACPI 1808 196K 290K 78643K 12628 0 0
file desc 6 17K 21K 78643K 2513 0 0
sigio 0 0K 0K 78643K 18 0 0
proc 54 51K 71K 78643K 808 0 0
subproc 64 65538K 67586K 78643K 648 0 0
NFS srvsock 1 0K 0K 78643K 1 0 0
NFS daemon 1 16K 16K 78643K 1 0 0
ip_moptions 0 0K 0K 78643K 114 0 0
in_multi 33 2K 2K 78643K 250 0 0
ether_multi 1 0K 0K 78643K 9 0 0
mrt 0 0K 0K 78643K 8 0 0
ISOFS mount 1 32K 32K 78643K 1 0 0
MSDOSFS mount 1 16K 16K 78643K 1 0 0
ttys 72 318K 318K 78643K 72 0 0
exec 0 0K 1K 78643K 379 0 0
pagedep 1 8K 8K 78643K 1 0 0
inodedep 1 32K 32K 78643K 1 0 0
newblk 1 0K 0K 78643K 1 0 0
VM swap 7 26K 26K 78643K 7 0 0
UVM amap 90 21K 30K 78643K 8414 0 0
UVM aobj 98 5K 5K 78643K 102 0 0
memdesc 1 4K 4K 78643K 1 0 0
crypto data 1 1K 1K 78643K 1 0 0
ip6_options 0 0K 0K 78643K 75 0 0
NDP 19 0K 0K 78643K 110 0 0
temp 221 2716K 2786K 78643K 10860 0 0
kqueue 0 0K 0K 78643K 18 0 0
SYN cache 2 16K 16K 78643K 2 0 0
ddb{0}> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg
Idle
arp 64 21 0 17 1 0 1 1 0
8 0
inpcbpl 280 954 0 947 2 1 1 2 0
8 0
plimitpl 152 102 0 94 1 0 1 1 0
8 0
plcache 128 20 0 0 1 0 1 1 0
8 0
rtentry 112 194 0 154 2 0 2 2 0
8 0
syncache 264 4 0 4 1 1 0 1 0
8 0
tcpqe 32 12 0 12 1 1 0 1 0
8 0
tcpcb 544 197 0 193 1 0 1 1 0
8 0
nd6 48 38 0 34 1 0 1 1 0
8 0
swfcl 56 1 0 0 1 0 1 1 0
8 0
ppxss 1128 28 0 28 6 6 0 1 0
8 0
pfosfp 40 846 0 423 5 0 5 5 0
8 0
pfosfpen 112 1428 0 714 21 0 21 21 0
8 0
pfstitem 24 45 0 38 1 0 1 1 0
8 0
pfstkey 112 45 0 38 1 0 1 1 0
8 0
pfstate 328 45 0 38 2 0 2 2 0
8 0
pfrule 1360 21 0 16 2 1 1 2 0
8 0
art_heap8 4096 1 0 0 1 0 1 1 0
8 0
art_heap4 256 917 0 726 12 0 12 12 0
8 0
art_table 32 918 0 726 2 0 2 2 0
8 0
art_node 16 193 0 159 1 0 1 1 0
8 0
sysvmsgpl 40 11 0 3 1 0 1 1 0
8 0
semupl 112 1 0 1 1 1 0 1 0
8 0
semapl 112 277 0 267 1 0 1 1 0
8 0
shmpl 112 100 0 4 3 0 3 3 0
8 0
dirhash 1024 17 0 0 3 0 3 3 0
8 0
dino1pl 128 6152 0 4684 49 1 48 48 0
8 0
ffsino 272 6152 0 4684 102 3 99 99 0
8 0
nchpl 144 9774 0 8106 62 0 62 62 0
8 0
uvmvnodes 72 5926 0 0 108 0 108 108 0
8 0
vnodes 200 5926 0 0 312 0 312 312 0
8 0
namei 1024 28205 0 28205 2 2 0 1 0
8 0
percpumem 16 30 0 0 1 0 1 1 0
8 0
scsiplug 64 3 0 3 2 2 0 1 0
8 0
scxspl 192 26117 0 26117 18 15 3 6 0
8 3
sigapl 432 2661 0 2645 2 0 2 2 0
8 0
futexpl 56 25052 0 25052 1 1 0 1 0
8 0
knotepl 112 634 0 615 2 1 1 2 0
8 0
kqueuepl 104 303 0 301 1 0 1 1 0
8 0
pipepl 112 1192 0 1173 3 2 1 2 0
8 0
fdescpl 488 2662 0 2645 4 1 3 3 0
8 0
filepl 152 13147 0 13047 8 4 4 7 0
8 0
lockfpl 104 501 0 501 4 4 0 1 0
8 0
lockfspl 32 182 0 182 4 4 0 1 0
8 0
sessionpl 112 35 0 24 1 0 1 1 0
8 0
pgrppl 48 53 0 42 1 0 1 1 0
8 0
ucredpl 96 1651 0 1642 1 0 1 1 0
8 0
zombiepl 144 2645 0 2645 3 3 0 1 0
8 0
processpl 840 2678 0 2645 4 0 4 4 0
8 0
procpl 600 7359 0 7313 4 0 4 4 0
8 0
srpgc 64 102 0 102 8 8 0 1 0
8 0
sosppl 128 11 0 11 5 5 0 1 0
8 0
sockpl 384 1574 0 1555 5 3 2 4 0
8 0
mcl64k 65536 350 0 0 37 3 34 34 0
8 0
mcl16k 16384 2 0 0 1 0 1 1 0
8 0
mcl12k 12288 17 0 0 2 0 2 2 0
8 0
mcl9k 9216 10 0 0 1 0 1 1 0
8 0
mcl8k 8192 13 0 0 2 0 2 2 0
8 0
mcl4k 4096 7 0 0 1 0 1 1 0
8 0
mcl2k2 2112 5 0 0 1 0 1 1 0
8 0
mcl2k 2048 129 0 0 15 0 15 15 0
8 0
mtagpl 80 1 0 0 1 0 1 1 0
8 0
mbufpl 256 467 0 0 21 0 21 21 0
8 0
bufpl 256 10001 0 2981 439 0 439 439 0
8 0
anonpl 16 257991 0 242735 102 40 62 62 0
125 0
amapchunkpl 152 15115 0 14994 34 28 6 10 0
158 0
amappl16 192 12358 0 11437 80 33 47 47 0
8 0
amappl15 184 868 0 867 3 2 1 1 0
8 0
amappl14 176 79 0 77 2 1 1 1 0
8 0
amappl13 168 283 0 283 5 5 0 1 0
8 0
amappl12 160 1071 0 1068 2 1 1 1 0
8 0
amappl11 152 347 0 328 1 0 1 1 0
8 0
amappl10 144 73 0 69 1 0 1 1 0
8 0
amappl9 136 832 0 828 1 0 1 1 0
8 0
amappl8 128 400 0 383 1 0 1 1 0
8 0
amappl7 120 70 0 63 1 0 1 1 0
8 0
amappl6 112 378 0 372 1 0 1 1 0
8 0
amappl5 104 1226 0 1210 1 0 1 1 0
8 0
amappl4 96 2084 0 2052 2 1 1 2 0
8 0
amappl3 88 1100 0 1094 1 0 1 1 0
8 0
amappl2 80 22521 0 22455 2 0 2 2 0
8 0
amappl1 72 63947 0 63487 26 16 10 20 0
8 0
amappl 72 7751 0 7713 1 0 1 1 0
75 0
dma4096 4096 1 0 1 1 1 0 1 0
8 0
dma256 256 6 0 6 1 1 0 1 0
8 0
dma64 64 259 0 259 1 1 0 1 0
8 0
dma32 32 7 0 7 1 1 0 1 0
8 0
dma16 16 17 0 17 1 1 0 1 0
8 0
aobjpl 64 101 0 4 2 0 2 2 0
8 0
uaddrrnd 24 2662 0 2645 1 0 1 1 0
8 0
uaddrbest 32 2 0 0 1 0 1 1 0
8 0
uaddr 24 2662 0 2645 1 0 1 1 0
8 0
vmmpekpl 168 22338 0 22312 2 0 2 2 0
8 0
vmmpepl 168 286952 0 284936 162 69 93 99 0
357 5
vmsppl 360 2661 0 2645 2 0 2 2 0
8 0
pdppl 4096 5332 0 5290 7 1 6 6 0
8 0
pvpl 32 757476 0 738418 227 73 154 155 0
265 0
pmappl 232 2661 0 2645 2 1 1 2 0
8 0
extentpl 40 39 0 25 1 0 1 1 0
8 0
phpool 112 648 0 12 19 0 19 19 0
8 0
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
May 2, 2019, 6:11:07 PM5/2/19
to syzkaller-o...@googlegroups.com
syzbot has found a reproducer for the following crash on:
HEAD commit: 975e1492 Index 0 is out of range for hrStorageIndex.
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=16a4c9e0a00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+c9a16d...@syzkaller.appspotmail.com
login: witness: panic: kernel diagnostic assertion "_kernel_lock_held()"
* 86986 14321 0 0 0x4000000 0 syz-executor.0
__assert+0x2e sys/kern/subr_prf.c:155
knote_enqueue(fffffd806e99ec40) at knote_enqueue+0x216
sys/kern/kern_event.c:1076
knote(ffffffff82338c38,1000000) at knote+0xbd sys/kern/kern_event.c:957
selwakeup(ffffffff82338c38) at selwakeup+0x3b sys/kern/sys_generic.c:795
witness_warn(2,0,ffffffff81f94722) at witness_warn+0x211
sys/kern/subr_witness.c:1416
userret(ffff800020b85c30) at userret+0x32a sys/kern/kern_sig.c:1902
syscall(ffff800020c13370) at syscall+0x614 mi_syscall_return
sys/sys/syscall_mi.h:122 [inline]
syscall(ffff800020c13370) at syscall+0x614 sys/arch/amd64/amd64/trap.c:596
Xsyscall(6,0,fffffffffffffef6,0,1,d68f9f821a0) at Xsyscall+0x128
end of kernel
end trace frame: 0x78, count: 3
__assert+0x2e sys/kern/subr_prf.c:155
knote_enqueue(fffffd806e99ec40) at knote_enqueue+0x216
sys/kern/kern_event.c:1076
knote(ffffffff82338c38,1000000) at knote+0xbd sys/kern/kern_event.c:957
selwakeup(ffffffff82338c38) at selwakeup+0x3b sys/kern/sys_generic.c:795
witness_warn(2,0,ffffffff81f94722) at witness_warn+0x211
sys/kern/subr_witness.c:1416
userret(ffff800020b85c30) at userret+0x32a sys/kern/kern_sig.c:1902
syscall(ffff800020c13370) at syscall+0x614 mi_syscall_return
sys/sys/syscall_mi.h:122 [inline]
syscall(ffff800020c13370) at syscall+0x614 sys/arch/amd64/amd64/trap.c:596
Xsyscall(6,0,fffffffffffffef6,0,1,d68f9f821a0) at Xsyscall+0x128
end of kernel
end trace frame: 0x78, count: -12
rbx 0xffff800020c12f90
rdx 0x8b
rcx 0x2
rax 0x1
r8 0xffffffff8140baf3 kprintf+0x173
r9 0x1
r10 0x47855f0b0ecbd4ac
r11 0x965d393a489a3e8a
r12 0x3000000008
r13 0xffff800020c12ef0
r14 0x100
r15 0x1
rip 0xffffffff814647a8 db_enter+0x18
cs 0x8
rflags 0x246
rsp 0xffff800020c12ed0
flags process=0 proc=4000000<THREAD>
pri=32, usrpri=86, nice=20
forw=0xffffffffffffffff, list=0xffff800020b159d0,0xffffffff82355ec8
process=0xffff800020b8d3c8 user=0xffff800020c0e000,
vmspace=0xfffffd807effe000
estcpu=36, cpticks=0, pctcpu=0.0
14321 408636 56857 0 2 0x4000000 syz-executor.0
14321 206648 56857 0 3 0x4000080 fsleep syz-executor.0
*14321 86986 56857 0 7 0x4000000 syz-executor.0
56857 266063 26686 0 3 0x82 nanosleep syz-executor.0
26686 457077 45542 0 3 0x82 thrsleep syz-execprog
26686 434506 45542 0 3 0x4000082 thrsleep syz-execprog
26686 75657 45542 0 3 0x4000082 thrsleep syz-execprog
26686 488498 45542 0 3 0x4000082 thrsleep syz-execprog
26686 360720 45542 0 3 0x4000082 thrsleep syz-execprog
26686 167281 45542 0 3 0x4000082 kqread syz-execprog
26686 182200 45542 0 3 0x4000082 thrsleep syz-execprog
45542 422297 93317 0 3 0x10008a pause ksh
93317 352243 97636 0 3 0x92 select sshd
33057 509657 1 0 3 0x100083 ttyin getty
97636 444364 1 0 3 0x80 select sshd
1040 301252 21182 74 3 0x100092 bpf pflogd
21182 510073 1 0 3 0x80 netio pflogd
3552 350631 5771 73 3 0x100090 kqread syslogd
5771 308847 1 0 3 0x100082 netio syslogd
33937 204033 1 77 3 0x100090 poll dhclient
87400 50168 1 0 3 0x80 poll dhclient
99468 372216 0 0 3 0x14200 pgzero zerothread
17093 77088 0 0 3 0x14200 aiodoned aiodoned
84904 350478 0 0 3 0x14200 syncer update
2617 31525 0 0 3 0x14200 cleaner cleaner
44893 73563 0 0 3 0x14200 reaper reaper
36295 439236 0 0 3 0x14200 pgdaemon pagedaemon
6197 324030 0 0 3 0x14200 bored crynlk
65412 397660 0 0 3 0x14200 bored crypto
70015 89141 0 0 3 0x40014200 acpi0 acpi0
37662 393446 0 0 3 0x40014200 idle1
48209 306617 0 0 3 0x14200 bored softnet
74389 97838 0 0 3 0x14200 bored systqmp
94054 482683 0 0 3 0x14200 bored systq
75013 434881 0 0 3 0x40014200 bored softclock
49689 516549 0 0 3 0x40014200 idle0
44827 389884 0 0 3 0x14200 bored smr
1 427473 0 0 3 0x82 wait init
HEAD commit: 975e1492 Index 0 is out of range for hrStorageIndex.
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=16a4c9e0a00000
kernel config: https://syzkaller.appspot.com/x/.config?x=fa145722143cbd64
dashboard link: https://syzkaller.appspot.com/bug?extid=c9a16d01c3b1eb8d5b65
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15a3c184a00000
dashboard link: https://syzkaller.appspot.com/bug?extid=c9a16d01c3b1eb8d5b65
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+c9a16d...@syzkaller.appspotmail.com
failed: file "/syzkaller/managers/multicore/kernel/sys/kern/kern_event.c",
line 1076
line 1076
Stopped at db_enter+0x18: addq $0x8,%rsp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
202908 14321 0 0 0 1 syz-executor.0
TID PID UID PRFLAGS PFLAGS CPU COMMAND
* 86986 14321 0 0 0x4000000 0 syz-executor.0
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic() at panic+0x15c sys/kern/subr_prf.c:208
__assert(ffffffff81f8e31d,ffffffff81f86db9,434,ffffffff81f98402) at
panic() at panic+0x15c sys/kern/subr_prf.c:208
__assert+0x2e sys/kern/subr_prf.c:155
knote_enqueue(fffffd806e99ec40) at knote_enqueue+0x216
sys/kern/kern_event.c:1076
knote(ffffffff82338c38,1000000) at knote+0xbd sys/kern/kern_event.c:957
selwakeup(ffffffff82338c38) at selwakeup+0x3b sys/kern/sys_generic.c:795
logwakeup() at logwakeup+0x3b sys/kern/subr_log.c:310
printf(ffffffff81f6bd50) at printf+0x9f sys/kern/subr_prf.c:519
witness_warn(2,0,ffffffff81f94722) at witness_warn+0x211
sys/kern/subr_witness.c:1416
userret(ffff800020b85c30) at userret+0x32a sys/kern/kern_sig.c:1902
syscall(ffff800020c13370) at syscall+0x614 mi_syscall_return
sys/sys/syscall_mi.h:122 [inline]
syscall(ffff800020c13370) at syscall+0x614 sys/arch/amd64/amd64/trap.c:596
Xsyscall(6,0,fffffffffffffef6,0,1,d68f9f821a0) at Xsyscall+0x128
end of kernel
end trace frame: 0x78, count: 3
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{0}>
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
kernel diagnostic assertion "_kernel_lock_held()" failed:
file "/syzkaller/managers/multicore/kernel/sys/kern/kern_event.c", line 1076
ddb{0}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic() at panic+0x15c sys/kern/subr_prf.c:208
__assert(ffffffff81f8e31d,ffffffff81f86db9,434,ffffffff81f98402) at
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{0}>
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
kernel diagnostic assertion "_kernel_lock_held()" failed:
file "/syzkaller/managers/multicore/kernel/sys/kern/kern_event.c", line 1076
ddb{0}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic() at panic+0x15c sys/kern/subr_prf.c:208
__assert+0x2e sys/kern/subr_prf.c:155
knote_enqueue(fffffd806e99ec40) at knote_enqueue+0x216
sys/kern/kern_event.c:1076
knote(ffffffff82338c38,1000000) at knote+0xbd sys/kern/kern_event.c:957
selwakeup(ffffffff82338c38) at selwakeup+0x3b sys/kern/sys_generic.c:795
logwakeup() at logwakeup+0x3b sys/kern/subr_log.c:310
printf(ffffffff81f6bd50) at printf+0x9f sys/kern/subr_prf.c:519
witness_warn(2,0,ffffffff81f94722) at witness_warn+0x211
sys/kern/subr_witness.c:1416
userret(ffff800020b85c30) at userret+0x32a sys/kern/kern_sig.c:1902
syscall(ffff800020c13370) at syscall+0x614 mi_syscall_return
sys/sys/syscall_mi.h:122 [inline]
syscall(ffff800020c13370) at syscall+0x614 sys/arch/amd64/amd64/trap.c:596
Xsyscall(6,0,fffffffffffffef6,0,1,d68f9f821a0) at Xsyscall+0x128
end of kernel
end trace frame: 0x78, count: -12
ddb{0}> show registers
rdi 0
rsi 0x1
rbp 0xffff800020c12ee0
rdi 0
rsi 0x1
rbx 0xffff800020c12f90
rdx 0x8b
rcx 0x2
rax 0x1
r8 0xffffffff8140baf3 kprintf+0x173
r9 0x1
r10 0x47855f0b0ecbd4ac
r11 0x965d393a489a3e8a
r12 0x3000000008
r13 0xffff800020c12ef0
r14 0x100
r15 0x1
rip 0xffffffff814647a8 db_enter+0x18
cs 0x8
rflags 0x246
rsp 0xffff800020c12ed0
ss 0x10
db_enter+0x18: addq $0x8,%rsp
ddb{0}> show proc
PROC (syz-executor.0) pid=86986 stat=onproc
db_enter+0x18: addq $0x8,%rsp
ddb{0}> show proc
flags process=0 proc=4000000<THREAD>
pri=32, usrpri=86, nice=20
forw=0xffffffffffffffff, list=0xffff800020b159d0,0xffffffff82355ec8
process=0xffff800020b8d3c8 user=0xffff800020c0e000,
vmspace=0xfffffd807effe000
estcpu=36, cpticks=0, pctcpu=0.0
user=0, sys=0, intr=0
ddb{0}> ps
PID TID PPID UID S FLAGS WAIT COMMAND
14321 202908 56857 0 7 0 syz-executor.0
ddb{0}> ps
PID TID PPID UID S FLAGS WAIT COMMAND
14321 408636 56857 0 2 0x4000000 syz-executor.0
14321 206648 56857 0 3 0x4000080 fsleep syz-executor.0
*14321 86986 56857 0 7 0x4000000 syz-executor.0
56857 266063 26686 0 3 0x82 nanosleep syz-executor.0
26686 457077 45542 0 3 0x82 thrsleep syz-execprog
26686 434506 45542 0 3 0x4000082 thrsleep syz-execprog
26686 75657 45542 0 3 0x4000082 thrsleep syz-execprog
26686 488498 45542 0 3 0x4000082 thrsleep syz-execprog
26686 360720 45542 0 3 0x4000082 thrsleep syz-execprog
26686 167281 45542 0 3 0x4000082 kqread syz-execprog
26686 182200 45542 0 3 0x4000082 thrsleep syz-execprog
45542 422297 93317 0 3 0x10008a pause ksh
93317 352243 97636 0 3 0x92 select sshd
33057 509657 1 0 3 0x100083 ttyin getty
97636 444364 1 0 3 0x80 select sshd
1040 301252 21182 74 3 0x100092 bpf pflogd
21182 510073 1 0 3 0x80 netio pflogd
3552 350631 5771 73 3 0x100090 kqread syslogd
5771 308847 1 0 3 0x100082 netio syslogd
33937 204033 1 77 3 0x100090 poll dhclient
87400 50168 1 0 3 0x80 poll dhclient
99468 372216 0 0 3 0x14200 pgzero zerothread
17093 77088 0 0 3 0x14200 aiodoned aiodoned
84904 350478 0 0 3 0x14200 syncer update
2617 31525 0 0 3 0x14200 cleaner cleaner
44893 73563 0 0 3 0x14200 reaper reaper
36295 439236 0 0 3 0x14200 pgdaemon pagedaemon
6197 324030 0 0 3 0x14200 bored crynlk
65412 397660 0 0 3 0x14200 bored crypto
70015 89141 0 0 3 0x40014200 acpi0 acpi0
37662 393446 0 0 3 0x40014200 idle1
48209 306617 0 0 3 0x14200 bored softnet
74389 97838 0 0 3 0x14200 bored systqmp
94054 482683 0 0 3 0x14200 bored systq
75013 434881 0 0 3 0x40014200 bored softclock
49689 516549 0 0 3 0x40014200 idle0
44827 389884 0 0 3 0x14200 bored smr
1 427473 0 0 3 0x82 wait init
syzbot
May 3, 2019, 9:22:06 AM5/3/19
to syzkaller-o...@googlegroups.com
syzbot has found a reproducer for the following crash on:
HEAD commit: baa2e1b7 Free host on exit path. Patch from markus at blu..
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=143ff078a00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16e019e0a00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+c9a16d...@syzkaller.appspotmail.com
login: witness: panic: kernel diagnostic assertion "_kernel_lock_held()"
failed: file "/syzkaller/managers/setuid/kernel/sys/kern/kern_event.c",
524263 34869 32767 0x10 0x480 0 syz-executor4079
__assert+0x2e sys/kern/subr_prf.c:155
knote_enqueue(fffffd806ec57d20) at knote_enqueue+0x216
sys/kern/kern_event.c:1076
knote(ffffffff8234b168,1000000) at knote+0xbd sys/kern/kern_event.c:957
selwakeup(ffffffff8234b168) at selwakeup+0x3b sys/kern/sys_generic.c:795
witness_warn(2,0,ffffffff81f92281) at witness_warn+0x211
sys/kern/subr_witness.c:1416
userret(ffff800020b14008) at userret+0x32a sys/kern/kern_sig.c:1902
syscall(ffff800020be5c90) at syscall+0x614 mi_syscall_return
sys/sys/syscall_mi.h:122 [inline]
syscall(ffff800020be5c90) at syscall+0x614 sys/arch/amd64/amd64/trap.c:596
Xsyscall(6,5,e9eef3fb288,0,e9eef3fb268,e9eef3fb260) at Xsyscall+0x128
end of kernel
end trace frame: 0xea1384dfa10, count: 3
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
ddb{1}> trace
__assert+0x2e sys/kern/subr_prf.c:155
knote_enqueue(fffffd806ec57d20) at knote_enqueue+0x216
sys/kern/kern_event.c:1076
knote(ffffffff8234b168,1000000) at knote+0xbd sys/kern/kern_event.c:957
selwakeup(ffffffff8234b168) at selwakeup+0x3b sys/kern/sys_generic.c:795
witness_warn(2,0,ffffffff81f92281) at witness_warn+0x211
sys/kern/subr_witness.c:1416
userret(ffff800020b14008) at userret+0x32a sys/kern/kern_sig.c:1902
syscall(ffff800020be5c90) at syscall+0x614 mi_syscall_return
sys/sys/syscall_mi.h:122 [inline]
syscall(ffff800020be5c90) at syscall+0x614 sys/arch/amd64/amd64/trap.c:596
Xsyscall(6,5,e9eef3fb288,0,e9eef3fb268,e9eef3fb260) at Xsyscall+0x128
end of kernel
end trace frame: 0xea1384dfa10, count: -12
ddb{1}> show registers
rdi 0
rsi 0x1
rbp 0xffff800020be5800
rbx 0xffff800020be58b0
r9 0x1
r10 0xbc7e49610bab61f9
r11 0xbffcad399a1fdb0c
r12 0x3000000008
r13 0xffff800020be5810
r14 0x100
r15 0x1
rip 0xffffffff81c2c858 db_enter+0x18
cs 0x8
rflags 0x246
rsp 0xffff800020be57f0
PROC (syz-executor4079) pid=311700 stat=onproc
flags process=10<SUGID> proc=4000000<THREAD>
pri=32, usrpri=63, nice=20
forw=0xffffffffffffffff, list=0xffff800020b14710,0xffff800020b15530
process=0xffff800020b3a6a0 user=0xffff800020be0000,
vmspace=0xfffffd807effd708
estcpu=13, cpticks=0, pctcpu=0.0
user=0, sys=0, intr=0
ddb{1}> ps
65336 244198 34620 32767 3 0x4000090 fsleep syz-executor4079
65336 433116 34620 32767 2 0x4000090 syz-executor4079
6806 264436 34869 32767 2 0x10 syz-executor4079
* 6806 311700 34869 32767 7 0x4000010 syz-executor4079
6806 40847 34869 32767 3 0x4000090 fsleep syz-executor4079
6806 485940 34869 32767 2 0x4000010 syz-executor4079
34620 380345 35052 32767 3 0x90 nanosleep syz-executor4079
34869 524263 36380 32767 7 0x490 syz-executor4079
35052 160964 65466 0 3 0x80 wait syz-executor4079
36380 308764 65466 0 3 0x80 wait syz-executor4079
65466 317990 65088 0 3 0x82 nanosleep syz-executor4079
65088 178656 11103 0 3 0x10008a pause ksh
11103 290261 80348 0 3 0x92 select sshd
6558 333422 1 0 3 0x100083 ttyin getty
80348 143113 1 0 3 0x80 select sshd
18416 362853 99472 73 3 0x100090 kqread syslogd
99472 255932 1 0 3 0x100082 netio syslogd
69013 313742 1 77 3 0x100090 poll dhclient
69575 318374 1 0 3 0x80 poll dhclient
76534 345340 0 0 3 0x14200 pgzero zerothread
25686 141498 0 0 3 0x14200 aiodoned aiodoned
80179 122887 0 0 3 0x14200 syncer update
70940 339976 0 0 3 0x14200 cleaner cleaner
9758 337158 0 0 3 0x14200 reaper reaper
84386 82687 0 0 3 0x14200 pgdaemon pagedaemon
86482 47439 0 0 3 0x14200 bored crynlk
50168 363702 0 0 3 0x14200 bored crypto
49943 436723 0 0 3 0x40014200 acpi0 acpi0
18709 120089 0 0 3 0x40014200 idle1
93715 326062 0 0 3 0x14200 bored softnet
38828 227400 0 0 3 0x14200 bored systqmp
7275 8963 0 0 3 0x14200 bored systq
96276 381000 0 0 3 0x40014200 bored softclock
73351 309821 0 0 3 0x40014200 idle0
45081 444877 0 0 3 0x14200 bored smr
1 405788 0 0 3 0x82 wait init
Process 6806 (syz-executor4079) thread 0xffff800020b14008 (311700)
exclusive rrwlock inode r = 0 (0xfffffd806f7cfa30)
#3 VOP_LOCK+0x4b sys/kern/vfs_vops.c:602
#4 vn_write+0x169 vn_lock sys/kern/vfs_vnops.c:549 [inline]
#4 vn_write+0x169 sys/kern/vfs_vnops.c:393
#5 dofilewritev+0x1a9 sys/kern/sys_generic.c:364
#6 sys_write+0x83 sys/kern/sys_generic.c:284
#7 syscall+0x552 mi_syscall sys/sys/syscall_mi.h:99 [inline]
#7 syscall+0x552 sys/arch/amd64/amd64/trap.c:574
#8 Xsyscall+0x128
ddb{1}> show malloc
pcb 23 9K 9K 78643K 55 0 0
rtable 61 2K 2K 78643K 115 0 0
ifaddr 21 7K 7K 78643K 21 0 0
proc 41 38K 46K 78643K 208 0 0
ether_multi 1 0K 0K 78643K 1 0 0
exec 0 0K 1K 78643K 152 0 0
UVM aobj 2 2K 2K 78643K 2 0 0
temp 30 2699K 2763K 78643K 2406 0 0
8 0
inpcbpl 280 22 0 16 1 0 1 1 0
8 0
plimitpl 152 15 0 8 1 0 1 1 0
8 0
syncache 264 5 0 5 2 2 0 1 0
8 0
tcpcb 544 8 0 5 1 0 1 1 0
8 0
8 0
art_table 32 97 0 0 1 0 1 1 0
8 0
art_node 16 22 0 2 1 0 1 1 0
8 0
8 0
ffsino 272 2641 0 1272 92 0 92 92 0
8 0
nchpl 144 3165 0 1637 57 0 57 57 0
8 0
uvmvnodes 72 2650 0 0 49 0 49 49 0
8 0
vnodes 200 2650 0 0 140 0 140 140 0
8 0
namei 1024 10294 0 10294 2 1 1 1 0
8 1
8 1
sigapl 432 531 0 515 2 0 2 2 0
8 0
futexpl 56 3093 0 3091 1 0 1 1 0
8 0
knotepl 112 5 0 0 1 0 1 1 0
8 0
kqueuepl 104 1 0 0 1 0 1 1 0
8 0
pipepl 112 118 0 111 2 1 1 1 0
8 0
fdescpl 488 532 0 515 3 0 3 3 0
8 0
filepl 152 5376 0 5325 3 0 3 3 0
8 0
lockfpl 104 6 0 6 1 1 0 1 0
8 0
lockfspl 32 3 0 3 1 1 0 1 0
8 0
sessionpl 112 19 0 9 1 0 1 1 0
8 0
pgrppl 48 19 0 9 1 0 1 1 0
8 0
ucredpl 96 4262 0 4253 1 0 1 1 0
8 0
zombiepl 144 515 0 515 3 2 1 1 0
8 1
processpl 840 547 0 515 4 0 4 4 0
8 0
procpl 600 1521 0 1484 5 2 3 4 0
8 0
sockpl 384 64 0 48 2 0 2 2 0
8 0
mcl4k 4096 2 0 0 1 0 1 1 0
8 0
mcl2k 2048 87 0 0 10 0 10 10 0
8 0
bufpl 256 2435 0 245 137 0 137 137 0
8 0
anonpl 16 39620 0 38347 7 1 6 6 0
125 0
amapchunkpl 152 2796 0 2745 3 0 3 3 0
158 0
amappl16 192 619 0 608 1 0 1 1 0
8 0
amappl14 176 14 0 13 3 2 1 1 0
8 0
amappl12 160 10 0 10 2 2 0 1 0
8 0
amappl11 152 44 0 30 1 0 1 1 0
8 0
amappl10 144 46 0 46 2 2 0 1 0
8 0
amappl9 136 413 0 407 1 0 1 1 0
8 0
amappl8 128 84 0 80 1 0 1 1 0
8 0
amappl7 120 15 0 14 1 0 1 1 0
8 0
amappl6 112 45 0 40 1 0 1 1 0
8 0
amappl5 104 116 0 107 1 0 1 1 0
8 0
amappl4 96 1088 0 1059 1 0 1 1 0
8 0
amappl3 88 107 0 101 1 0 1 1 0
8 0
amappl2 80 3730 0 3672 2 0 2 2 0
8 0
amappl1 72 24121 0 23642 14 4 10 14 0
8 0
amappl 72 1700 0 1668 1 0 1 1 0
8 0
uaddrrnd 24 532 0 515 1 0 1 1 0
8 0
vmmpekpl 168 8055 0 8034 2 0 2 2 0
8 0
vmmpepl 168 56587 0 55621 62 19 43 44 0
357 0
vmsppl 360 531 0 515 2 0 2 2 0
8 0
pdppl 4096 1072 0 1030 6 0 6 6 0
8 0
pvpl 32 120993 0 117875 33 7 26 26 0
265 0
pmappl 232 531 0 515 1 0 1 1 0
8 0
8 0
HEAD commit: baa2e1b7 Free host on exit path. Patch from markus at blu..
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=143ff078a00000
kernel config: https://syzkaller.appspot.com/x/.config?x=fa145722143cbd64
dashboard link: https://syzkaller.appspot.com/bug?extid=c9a16d01c3b1eb8d5b65
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15cada68a00000
dashboard link: https://syzkaller.appspot.com/bug?extid=c9a16d01c3b1eb8d5b65
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16e019e0a00000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+c9a16d...@syzkaller.appspotmail.com
failed: file "/syzkaller/managers/setuid/kernel/sys/kern/kern_event.c",
line 1076
Stopped at db_enter+0x18: addq $0x8,%rsp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
*311700 6806 32767 0x10 0x4000000 1 syz-executor4079
Stopped at db_enter+0x18: addq $0x8,%rsp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
524263 34869 32767 0x10 0x480 0 syz-executor4079
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic() at panic+0x15c sys/kern/subr_prf.c:208
__assert(ffffffff81f8c2bf,ffffffff81f90d96,434,ffffffff81f96de6) at
panic() at panic+0x15c sys/kern/subr_prf.c:208
__assert+0x2e sys/kern/subr_prf.c:155
knote_enqueue(fffffd806ec57d20) at knote_enqueue+0x216
sys/kern/kern_event.c:1076
knote(ffffffff8234b168,1000000) at knote+0xbd sys/kern/kern_event.c:957
selwakeup(ffffffff8234b168) at selwakeup+0x3b sys/kern/sys_generic.c:795
logwakeup() at logwakeup+0x3b sys/kern/subr_log.c:310
printf(ffffffff81f6acf3) at printf+0x9f sys/kern/subr_prf.c:519
witness_warn(2,0,ffffffff81f92281) at witness_warn+0x211
sys/kern/subr_witness.c:1416
userret(ffff800020b14008) at userret+0x32a sys/kern/kern_sig.c:1902
syscall(ffff800020be5c90) at syscall+0x614 mi_syscall_return
sys/sys/syscall_mi.h:122 [inline]
syscall(ffff800020be5c90) at syscall+0x614 sys/arch/amd64/amd64/trap.c:596
Xsyscall(6,5,e9eef3fb288,0,e9eef3fb268,e9eef3fb260) at Xsyscall+0x128
end of kernel
end trace frame: 0xea1384dfa10, count: 3
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{1}>
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
kernel diagnostic assertion "_kernel_lock_held()" failed:
file "/syzkaller/managers/setuid/kernel/sys/kern/kern_event.c", line 1076
ddb{1}> trace
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic() at panic+0x15c sys/kern/subr_prf.c:208
__assert(ffffffff81f8c2bf,ffffffff81f90d96,434,ffffffff81f96de6) at
panic() at panic+0x15c sys/kern/subr_prf.c:208
__assert+0x2e sys/kern/subr_prf.c:155
knote_enqueue(fffffd806ec57d20) at knote_enqueue+0x216
sys/kern/kern_event.c:1076
knote(ffffffff8234b168,1000000) at knote+0xbd sys/kern/kern_event.c:957
selwakeup(ffffffff8234b168) at selwakeup+0x3b sys/kern/sys_generic.c:795
logwakeup() at logwakeup+0x3b sys/kern/subr_log.c:310
printf(ffffffff81f6acf3) at printf+0x9f sys/kern/subr_prf.c:519
witness_warn(2,0,ffffffff81f92281) at witness_warn+0x211
sys/kern/subr_witness.c:1416
userret(ffff800020b14008) at userret+0x32a sys/kern/kern_sig.c:1902
syscall(ffff800020be5c90) at syscall+0x614 mi_syscall_return
sys/sys/syscall_mi.h:122 [inline]
syscall(ffff800020be5c90) at syscall+0x614 sys/arch/amd64/amd64/trap.c:596
Xsyscall(6,5,e9eef3fb288,0,e9eef3fb268,e9eef3fb260) at Xsyscall+0x128
end of kernel
end trace frame: 0xea1384dfa10, count: -12
ddb{1}> show registers
rdi 0
rsi 0x1
rbp 0xffff800020be5800
rbx 0xffff800020be58b0
rdx 0x8b
rcx 0x2
rax 0x1
r8 0xffffffff81df1983 kprintf+0x173
rcx 0x2
rax 0x1
r9 0x1
r10 0xbc7e49610bab61f9
r11 0xbffcad399a1fdb0c
r12 0x3000000008
r13 0xffff800020be5810
r14 0x100
r15 0x1
rip 0xffffffff81c2c858 db_enter+0x18
cs 0x8
rflags 0x246
rsp 0xffff800020be57f0
ss 0x10
db_enter+0x18: addq $0x8,%rsp
ddb{1}> show proc
db_enter+0x18: addq $0x8,%rsp
PROC (syz-executor4079) pid=311700 stat=onproc
flags process=10<SUGID> proc=4000000<THREAD>
pri=32, usrpri=63, nice=20
forw=0xffffffffffffffff, list=0xffff800020b14710,0xffff800020b15530
process=0xffff800020b3a6a0 user=0xffff800020be0000,
vmspace=0xfffffd807effd708
estcpu=13, cpticks=0, pctcpu=0.0
user=0, sys=0, intr=0
ddb{1}> ps
PID TID PPID UID S FLAGS WAIT COMMAND
65336 393080 34620 32767 2 0x10 syz-executor4079
65336 244198 34620 32767 3 0x4000090 fsleep syz-executor4079
65336 433116 34620 32767 2 0x4000090 syz-executor4079
6806 264436 34869 32767 2 0x10 syz-executor4079
* 6806 311700 34869 32767 7 0x4000010 syz-executor4079
6806 40847 34869 32767 3 0x4000090 fsleep syz-executor4079
6806 485940 34869 32767 2 0x4000010 syz-executor4079
34620 380345 35052 32767 3 0x90 nanosleep syz-executor4079
34869 524263 36380 32767 7 0x490 syz-executor4079
35052 160964 65466 0 3 0x80 wait syz-executor4079
36380 308764 65466 0 3 0x80 wait syz-executor4079
65466 317990 65088 0 3 0x82 nanosleep syz-executor4079
65088 178656 11103 0 3 0x10008a pause ksh
11103 290261 80348 0 3 0x92 select sshd
6558 333422 1 0 3 0x100083 ttyin getty
80348 143113 1 0 3 0x80 select sshd
18416 362853 99472 73 3 0x100090 kqread syslogd
99472 255932 1 0 3 0x100082 netio syslogd
69013 313742 1 77 3 0x100090 poll dhclient
69575 318374 1 0 3 0x80 poll dhclient
76534 345340 0 0 3 0x14200 pgzero zerothread
25686 141498 0 0 3 0x14200 aiodoned aiodoned
80179 122887 0 0 3 0x14200 syncer update
70940 339976 0 0 3 0x14200 cleaner cleaner
9758 337158 0 0 3 0x14200 reaper reaper
84386 82687 0 0 3 0x14200 pgdaemon pagedaemon
86482 47439 0 0 3 0x14200 bored crynlk
50168 363702 0 0 3 0x14200 bored crypto
49943 436723 0 0 3 0x40014200 acpi0 acpi0
18709 120089 0 0 3 0x40014200 idle1
93715 326062 0 0 3 0x14200 bored softnet
38828 227400 0 0 3 0x14200 bored systqmp
7275 8963 0 0 3 0x14200 bored systq
96276 381000 0 0 3 0x40014200 bored softclock
73351 309821 0 0 3 0x40014200 idle0
45081 444877 0 0 3 0x14200 bored smr
1 405788 0 0 3 0x82 wait init
0 0 -1 0 3 0x10200 scheduler swapper
ddb{1}> show all locks
Process 6806 (syz-executor4079) thread 0xffff800020b14008 (311700)
exclusive rrwlock inode r = 0 (0xfffffd806f7cfa30)
#0 witness_lock+0x52e sys/kern/subr_witness.c:1161
#1 rw_enter+0x414 sys/kern/kern_rwlock.c:278
#2 rrw_enter+0x4f sys/kern/kern_rwlock.c:407
#1 rw_enter+0x414 sys/kern/kern_rwlock.c:278
#3 VOP_LOCK+0x4b sys/kern/vfs_vops.c:602
#4 vn_write+0x169 vn_lock sys/kern/vfs_vnops.c:549 [inline]
#4 vn_write+0x169 sys/kern/vfs_vnops.c:393
#5 dofilewritev+0x1a9 sys/kern/sys_generic.c:364
#6 sys_write+0x83 sys/kern/sys_generic.c:284
#7 syscall+0x552 mi_syscall sys/sys/syscall_mi.h:99 [inline]
#7 syscall+0x552 sys/arch/amd64/amd64/trap.c:574
#8 Xsyscall+0x128
ddb{1}> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim Kern Lim
devbuf 9447 6316K 6316K 78643K 10534 0 0
pcb 23 9K 9K 78643K 55 0 0
rtable 61 2K 2K 78643K 115 0 0
ifaddr 21 7K 7K 78643K 21 0 0
counters 39 33K 33K 78643K 39 0 0
ioctlops 0 0K 2K 78643K 13 0 0
mount 1 1K 1K 78643K 1 0 0
vnodes 1166 73K 73K 78643K 2078 0 0
UFS quota 1 32K 32K 78643K 1 0 0
UFS mount 5 36K 36K 78643K 5 0 0
shm 2 1K 1K 78643K 2 0 0
UFS mount 5 36K 36K 78643K 5 0 0
VM map 2 1K 1K 78643K 2 0 0
sem 2 0K 0K 78643K 2 0 0
dirhash 12 2K 2K 78643K 12 0 0
ACPI 1808 196K 290K 78643K 12628 0 0
file desc 3 4K 5K 78643K 1054 0 0
ACPI 1808 196K 290K 78643K 12628 0 0
proc 41 38K 46K 78643K 208 0 0
NFS srvsock 1 0K 0K 78643K 1 0 0
NFS daemon 1 16K 16K 78643K 1 0 0
in_multi 11 0K 0K 78643K 11 0 0
NFS daemon 1 16K 16K 78643K 1 0 0
ether_multi 1 0K 0K 78643K 1 0 0
ISOFS mount 1 32K 32K 78643K 1 0 0
MSDOSFS mount 1 16K 16K 78643K 1 0 0
ttys 48 212K 212K 78643K 48 0 0
MSDOSFS mount 1 16K 16K 78643K 1 0 0
exec 0 0K 1K 78643K 152 0 0
pagedep 1 8K 8K 78643K 1 0 0
inodedep 1 32K 32K 78643K 1 0 0
newblk 1 0K 0K 78643K 1 0 0
VM swap 7 26K 26K 78643K 7 0 0
UVM amap 64 19K 19K 78643K 1994 0 0
inodedep 1 32K 32K 78643K 1 0 0
newblk 1 0K 0K 78643K 1 0 0
VM swap 7 26K 26K 78643K 7 0 0
UVM aobj 2 2K 2K 78643K 2 0 0
memdesc 1 4K 4K 78643K 1 0 0
crypto data 1 1K 1K 78643K 1 0 0
NDP 3 0K 0K 78643K 3 0 0
crypto data 1 1K 1K 78643K 1 0 0
temp 30 2699K 2763K 78643K 2406 0 0
SYN cache 2 16K 16K 78643K 2 0 0
ddb{1}> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg
Idle
arp 64 2 0 0 1 0 1 1 0
Idle
8 0
inpcbpl 280 22 0 16 1 0 1 1 0
8 0
plimitpl 152 15 0 8 1 0 1 1 0
8 0
plcache 128 20 0 0 1 0 1 1 0
8 0
rtentry 112 23 0 1 1 0 1 1 0
plcache 128 20 0 0 1 0 1 1 0
8 0
8 0
syncache 264 5 0 5 2 2 0 1 0
8 0
tcpcb 544 8 0 5 1 0 1 1 0
8 0
art_heap8 4096 1 0 0 1 0 1 1 0
8 0
art_heap4 256 96 0 0 6 0 6 6 0
8 0
8 0
art_table 32 97 0 0 1 0 1 1 0
8 0
art_node 16 22 0 2 1 0 1 1 0
8 0
dirhash 1024 17 0 0 3 0 3 3 0
8 0
dino1pl 128 2641 0 1272 45 0 45 45 0
8 0
8 0
ffsino 272 2641 0 1272 92 0 92 92 0
8 0
nchpl 144 3165 0 1637 57 0 57 57 0
8 0
uvmvnodes 72 2650 0 0 49 0 49 49 0
8 0
vnodes 200 2650 0 0 140 0 140 140 0
8 0
namei 1024 10294 0 10294 2 1 1 1 0
8 1
percpumem 16 30 0 0 1 0 1 1 0
8 0
scxspl 192 5202 0 5202 13 12 1 6 0
8 0
8 1
sigapl 432 531 0 515 2 0 2 2 0
8 0
futexpl 56 3093 0 3091 1 0 1 1 0
8 0
knotepl 112 5 0 0 1 0 1 1 0
8 0
kqueuepl 104 1 0 0 1 0 1 1 0
8 0
pipepl 112 118 0 111 2 1 1 1 0
8 0
fdescpl 488 532 0 515 3 0 3 3 0
8 0
filepl 152 5376 0 5325 3 0 3 3 0
8 0
lockfpl 104 6 0 6 1 1 0 1 0
8 0
lockfspl 32 3 0 3 1 1 0 1 0
8 0
sessionpl 112 19 0 9 1 0 1 1 0
8 0
pgrppl 48 19 0 9 1 0 1 1 0
8 0
ucredpl 96 4262 0 4253 1 0 1 1 0
8 0
zombiepl 144 515 0 515 3 2 1 1 0
8 1
processpl 840 547 0 515 4 0 4 4 0
8 0
procpl 600 1521 0 1484 5 2 3 4 0
8 0
sockpl 384 64 0 48 2 0 2 2 0
8 0
mcl4k 4096 2 0 0 1 0 1 1 0
8 0
mcl2k 2048 87 0 0 10 0 10 10 0
8 0
mtagpl 80 1 0 0 1 0 1 1 0
8 0
mbufpl 256 123 0 0 7 0 7 7 0
mtagpl 80 1 0 0 1 0 1 1 0
8 0
8 0
bufpl 256 2435 0 245 137 0 137 137 0
8 0
anonpl 16 39620 0 38347 7 1 6 6 0
125 0
amapchunkpl 152 2796 0 2745 3 0 3 3 0
158 0
amappl16 192 619 0 608 1 0 1 1 0
8 0
amappl14 176 14 0 13 3 2 1 1 0
8 0
amappl12 160 10 0 10 2 2 0 1 0
8 0
amappl11 152 44 0 30 1 0 1 1 0
8 0
amappl10 144 46 0 46 2 2 0 1 0
8 0
amappl9 136 413 0 407 1 0 1 1 0
8 0
amappl8 128 84 0 80 1 0 1 1 0
8 0
amappl7 120 15 0 14 1 0 1 1 0
8 0
amappl6 112 45 0 40 1 0 1 1 0
8 0
amappl5 104 116 0 107 1 0 1 1 0
8 0
amappl4 96 1088 0 1059 1 0 1 1 0
8 0
amappl3 88 107 0 101 1 0 1 1 0
8 0
amappl2 80 3730 0 3672 2 0 2 2 0
8 0
amappl1 72 24121 0 23642 14 4 10 14 0
8 0
amappl 72 1700 0 1668 1 0 1 1 0
75 0
dma4096 4096 1 0 1 1 1 0 1 0
8 0
dma256 256 6 0 6 1 1 0 1 0
8 0
dma64 64 259 0 259 1 1 0 1 0
8 0
dma32 32 7 0 7 1 1 0 1 0
8 0
dma16 16 17 0 17 1 1 0 1 0
8 0
aobjpl 64 1 0 0 1 0 1 1 0
dma4096 4096 1 0 1 1 1 0 1 0
8 0
dma256 256 6 0 6 1 1 0 1 0
8 0
dma64 64 259 0 259 1 1 0 1 0
8 0
dma32 32 7 0 7 1 1 0 1 0
8 0
dma16 16 17 0 17 1 1 0 1 0
8 0
8 0
uaddrrnd 24 532 0 515 1 0 1 1 0
8 0
uaddrbest 32 2 0 0 1 0 1 1 0
8 0
uaddr 24 532 0 515 1 0 1 1 0
uaddrbest 32 2 0 0 1 0 1 1 0
8 0
8 0
vmmpekpl 168 8055 0 8034 2 0 2 2 0
8 0
vmmpepl 168 56587 0 55621 62 19 43 44 0
357 0
vmsppl 360 531 0 515 2 0 2 2 0
8 0
pdppl 4096 1072 0 1030 6 0 6 6 0
8 0
pvpl 32 120993 0 117875 33 7 26 26 0
265 0
pmappl 232 531 0 515 1 0 1 1 0
8 0
extentpl 40 39 0 25 1 0 1 1 0
8 0
phpool 112 268 0 3 8 0 8 8 0
8 0
8 0
Anton Lindqvist
Jun 3, 2019, 4:39:52 AM6/3/19
to syzbot, syzkaller-o...@googlegroups.com
#syz fix: Removed all diagnostic, calling printf() here might create a recursion.
Not really fixed but the assertion is gone and this will hopefully be
revisited at some point.
Not really fixed but the assertion is gone and this will hopefully be
revisited at some point.
Reply all
Reply to author
Forward
0 new messages